arbiscan[.]vip

This domain is flagged as a high-risk crypto drainer scheme designed to compromise cryptocurrency wallet credentials and siphon digital assets. Analysis indicates the site employs deceptive interfaces mimicking legitimate blockchain explorers to trick users into authorizing malicious transactions, leading to irreversible asset loss. The threat type is classified as a crypto drainer due to its focus on wallet exploitation and unauthorized fund transfers. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain arbiscan.vip resolves to IP address 188.114.96.3 and was registered on May 12, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com. Security vendors on VirusTotal flagged the domain at a ratio of 17/95, while it appears on four independent security blocklists, including MetaMask, PhishDestroy, SEAL, and ScamSniffer. Detected technologies include HSTS, Crisp Live Chat, and Cloudflare, suggesting an attempt to appear legitimate while masking malicious intent. The domain is currently offline, but its infrastructure remains a latent threat. Mitigation steps for users who may have interacted with this domain include immediate revocation of any wallet authorizations granted to arbiscan.vip or associated smart contracts. Users should audit their transaction history for unauthorized transfers and transfer remaining assets to a new, secure wallet. Security teams are advised to block the domain and its resolving IP at the network level, monitor for related phishing campaigns, and educate users on identifying crypto drainer tactics, such as unsolicited transaction prompts or fake wallet interfaces. Given the high-risk classification, all interactions with this domain should be treated as compromised.